CVE-2022-45136 Apache Jena SDB allows arbitrary deserialisation via JDBC

Apache Jena SDB 3.17.0 and earlier is vulnerable to a JDBC Deserialisation attack if the attacker is able to control the JDBC URL used or cause the underlying database server to return malicious data. The mySQL JDBC driver in particular is known to be vulnerable to this class of attack. As a resu...

CVE-2022-43488

Cross-Site Request Forgery CSRF vulnerability in Advanced Dynamic Pricing for WooCommerce plugin = 4.1.5 on WordPress leading to rule type migration...

CVE-2022-43488

Cross-Site Request Forgery CSRF vulnerability in Advanced Dynamic Pricing for WooCommerce plugin = 4.1.5 on WordPress leading to rule type migration...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Advanced Dynamic Pricing for WooCommerce plugin = 4.1.5 on WordPress leading to rule type migration...

CVE-2022-43488 WordPress Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Advanced Dynamic Pricing for WooCommerce plugin = 4.1.5 on WordPress leading to rule type migration...

PT-2022-26940 · Woocommerce · Advanced Dynamic Pricing For Woocommerce

Name of the Vulnerable Software and Affected Versions: Advanced Dynamic Pricing for WooCommerce plugin versions = 4.1.5 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability, which can lead to rule type migration. Recommendations: For Advanced Dynamic Pricing for...

SolarWinds Orion Secrets Dump

This module exports and decrypts credentials from SolarWinds Orion Network Performance Monitor NPM to a CSV file; it is intended as a post-exploitation module for Windows hosts with SolarWinds Orion NPM installed. The module supports decryption of AES-256, RSA, and XMLSEC secrets. Separate action...

Contracts will not working correctly after February 2106. Vesting will be locked forever if withdrawn after February 2106.

Lines of code Vulnerability details Impact Contracts will not working correctly after February 2106. Migration takes costs and is risky. You shouldn't pass on this work to future programmers. You should fix it in the first place. In case anything went wrong during migration, a big fund loss will...

CVE-2022-41671

A CWE-89: Improper Neutralization of Special Elements used in SQL Command ‘SQL Injection’ vulnerability exists that allows adversaries with local user privileges to craft a malicious SQL query and execute as part of project migration which could result in execution of malicious code. Affected...

CVE-2022-41671

A CWE-89: Improper Neutralization of Special Elements used in SQL Command ‘SQL Injection’ vulnerability exists that allows adversaries with local user privileges to craft a malicious SQL query and execute as part of project migration which could result in execution of malicious code. Affected...

Xen 安全漏洞

Xen is an open source virtual machine monitor product from the University of Cambridge, UK. The product enables different and incompatible operating systems to run on the same computer and supports runtime migration to ensure uptime and avoid downtime. Xen Xenstore suffers from a security...

Xen 安全漏洞

Xen is an open source virtual machine monitor product from the University of Cambridge, UK. The product enables different and incompatible operating systems to run on the same computer and supports migration at runtime to ensure uptime and avoid downtime. Xen Xenstore suffers from a security...

SUSE: Security Advisory (SUSE-SU-2022:3767-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2022:3750-1 Security update for SUSE Manager Server 4.3

This update fixes the following issues: cobbler: - Consider case of 'nextserver' being a hostname during migration of Cobbler collections. - Fix problem with 'proxyurlext' setting being None type. - Fix settings migration schema to work while upgrading on existing running Uyuni and SUSE Manager...

How Imperva Mitigates Security Threats in Oracle Cloud Infrastructures

Most organizations today rely on an unprecedented number of computing resources to build, deploy and scale the workflows and applications they need to succeed. They are responsible for more data than ever before, on-premises and in the cloud, which presents them with challenges they’ve never face...

Security Bulletin: IBM Sterling Order Management migration strategy to Apache Log4j vulnerability [CVE-2022-23307]

Summary Apache Log4j is used by IBM Sterling Order Management as part of its logging utility and we strongly recommend upgrading to the latest supported version of log4j that was released as part of the latest FixPack CVE-2022-23307. Vulnerability Details CVEID:CVE-2022-23307 DESCRIPTION: Apache...

Xen 安全漏洞

Xen is an open source virtual machine monitor product from the University of Cambridge, UK. The product enables different and incompatible operating systems to run on the same computer and supports runtime migration to ensure uptime and avoid downtime. Xen has a security vulnerability. An attacke...

PT-2022-6532 · Schneider Electric · Ecostruxure Operator Terminal Expert +1

Name of the Vulnerable Software and Affected Versions: EcoStruxure Operator Terminal Expert versions V3.3 Hotfix 1 or prior Pro-face BLUE versions V3.3 Hotfix 1 or prior Description: A SQL Injection vulnerability exists, allowing adversaries with local user privileges to craft a malicious SQL que...

Liberapay: Email Address Exposure via Gratipay Migration Tool

Through the /migrate route, an attacker can input the username of any user on the site and retrieve their primary email address without any authorization required. Steps to reproduce: Note: This cannot be performed with hackerone-target, because that account seems to return a None as an email. 1...

PT-2022-6493

Name of the Vulnerable Software and Affected Versions Linux Kernel affected versions not specified Description A vulnerability in the Linux Kernel has been classified as problematic. It affects an unknown function of the file mm/memory.c of the component Driver Handler, leading to use after free...